CVE-2022-24802

CVE-2022-24802 affects the TypeScript library deepmerge-ts via prototype pollution in deepmerge.ts (defaultMergeRecords). The issue has been patched in version 4.0.2; remediation is to upgrade to 4.0.2 or later. The connected documents do not provide public exploit details or workarounds beyond t...

deepmerge-ts 安全漏洞

deepmerge-ts is an npm package. It is used to deep merge 2 or more objects with respect to type information. A security vulnerability exists in deepmerge-ts that stems from prototype contamination in the defaultMergeRecords function of the deepmerge.ts file...

CVE-2022-24802: Improperly Controlled Modification of Dynamically-Determined Object Attributes

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords. This issue has been patched in version 4.0.2. There are no known workarounds for this issue...

ts-free-host.de Improper Access Control vulnerability OBB-2404930

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-45860

An integer overflow in DTSStreamReader::findFrame of tsMuxer git-2678966 allows attackers to cause a Denial of Service DoS via a crafted file...

CVE-2021-45860

An integer overflow in DTSStreamReader::findFrame of tsMuxer git-2678966 allows attackers to cause a Denial of Service DoS via a crafted file...

CVE-2021-45861

There is an Assertion num = INTBIT' failed at BitStreamReader::skipBits in /bitStream.h:132 of tsMuxer git-c6a0277...

@stackstorm/st2-build (>=2.3.1, <=2.4.3), ccxt-without-theocean (1.18.151) +3 more potentially affected by CVE-2021-23518 via cached-path-relative (1.0.2)

cached-path-relative NPM version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cached-path-relative and may be impacted: - @stackstorm/st2-build =2.3.1, =1.0.0, =1.18.173, =1.18.242 Source cves: CVE-2021-23518 Source advisory:...

CVE-2021-38674

A cross-site scripting XSS vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QuTS hero...

ts-snack.com Cross Site Scripting vulnerability OBB-2320666

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-39652

In sectsparsingcmds of TBD, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...

Prototype Pollution in ts-nodash

ts-nodash before version 1.2.7 is vulnerable to Prototype Pollution via the Merge function due to lack of validation input...

GHSA-5XJX-4XCM-HPCM Prototype Pollution in ts-nodash

ts-nodash before version 1.2.7 is vulnerable to Prototype Pollution via the Merge function due to lack of validation input...

CVE-2021-20121

The Telus Wi-Fi Hub PRV65B444A-S-TS with firmware version 3.00.20 is vulnerable to an authenticated arbitrary file read. An authenticated user with physical access to the device can read arbitrary files from the device by preparing and connecting a specially prepared USB drive to the device, and...

Command injection

The Telus Wi-Fi Hub PRV65B444A-S-TS with firmware version 3.00.20 is affected by an authenticated command injection vulnerability in multiple parameters passed to tr69cmd.cgi. A remote attacker connected to the router's LAN and authenticated with a super user account, or using a bypass...

CVE-2021-20122

CVE-2021-20122 affects Telus Wi-Fi Hub (PRV65B444A-S-TS) firmware 3.00.20. It is an authenticated command-injection vulnerability in multiple parameters passed to tr69_cmd.cgi. An attacker who is connected to the LAN and authenticated with a super user account, or who exploits a bypass authentica...

CVE-2021-20121: Undefined Security Weakness

The Telus Wi-Fi Hub PRV65B444A-S-TS with firmware version 3.00.20 is vulnerable to an authenticated arbitrary file read. An authenticated user with physical access to the device can read arbitrary files from the device by preparing and connecting a specially prepared USB drive to the device, and...

CVE-2021-38412

Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to...

CVE-2021-38412

Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to...

Authentication flaw

Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to...